crewly 1.20.429 → 1.20.431

package/dist/backend/backend/src/services/core/dashboard-build.d.ts

@@ -19,6 +19,26 @@ import type { RequestHandler } from 'express';
  * @returns e.g. `/assets/index-b91a9801.js`, or null for a dev / unbuilt page
  */
 export declare function parseDashboardEntry(html: string): string | null;
+/**
+ * CSP hash sources of the inline scripts of a built `index.html`.
+ *
+ * The page themes itself before first paint with an inline script
+ * (`THEME_INIT_SCRIPT`); the Content-Security-Policy is `script-src 'self'`,
+ * which blocks inline scripts unless their hash is listed. The hash is of
+ * the script body exactly as served, so it is computed from the file
+ * rather than written down (a changed script would silently stop running).
+ *
+ * @param html - index.html content
+ * @returns e.g. `["'sha256-…'"]` — one per inline script, in order
+ */
+export declare function inlineScriptHashes(html: string): string[];
+/**
+ * Read the inline-script CSP hashes of the dashboard this backend serves.
+ *
+ * @param indexHtmlPath - Path of `frontend/dist/index.html`
+ * @returns The hash sources, [] when there is no built dashboard
+ */
+export declare function loadInlineScriptHashes(indexHtmlPath: string): string[];
 /**
  * Read the entry script of the dashboard this backend serves.
  *

package/dist/backend/backend/src/services/core/dashboard-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-build.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/dashboard-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAG/E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAKzE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAEpH"}
+{"version":3,"file":"dashboard-build.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/core/dashboard-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAG/E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CASzD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAMtE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAKzE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAEpH"}

package/dist/backend/backend/src/services/core/dashboard-build.js

@@ -12,6 +12,7 @@
  * @module services/core/dashboard-build
  */
 import * as fs from 'fs';
+import { createHash } from 'crypto';
 import { OWNER_AUTH_CONSTANTS } from '../../constants.js';
 /**
  * The entry script of a built `index.html`.
@@ -29,6 +30,43 @@ export function parseDashboardEntry(html) {
     }
     return null;
 }
+/**
+ * CSP hash sources of the inline scripts of a built `index.html`.
+ *
+ * The page themes itself before first paint with an inline script
+ * (`THEME_INIT_SCRIPT`); the Content-Security-Policy is `script-src 'self'`,
+ * which blocks inline scripts unless their hash is listed. The hash is of
+ * the script body exactly as served, so it is computed from the file
+ * rather than written down (a changed script would silently stop running).
+ *
+ * @param html - index.html content
+ * @returns e.g. `["'sha256-…'"]` — one per inline script, in order
+ */
+export function inlineScriptHashes(html) {
+    const out = [];
+    const re = /<script\b([^>]*)>([\s\S]*?)<\/script>/gi;
+    let m;
+    while ((m = re.exec(html)) !== null) {
+        if (/\bsrc=/i.test(m[1]) || m[2].trim() === '')
+            continue;
+        out.push(`'sha256-${createHash('sha256').update(m[2], 'utf8').digest('base64')}'`);
+    }
+    return out;
+}
+/**
+ * Read the inline-script CSP hashes of the dashboard this backend serves.
+ *
+ * @param indexHtmlPath - Path of `frontend/dist/index.html`
+ * @returns The hash sources, [] when there is no built dashboard
+ */
+export function loadInlineScriptHashes(indexHtmlPath) {
+    try {
+        return inlineScriptHashes(fs.readFileSync(indexHtmlPath, 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Read the entry script of the dashboard this backend serves.
  *

package/dist/backend/backend/src/services/core/dashboard-build.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-build.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/dashboard-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAChE,IAAI,KAAK;YAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7G,CAAC"}
+{"version":3,"file":"dashboard-build.js","sourceRoot":"","sources":["../../../../../../backend/src/services/core/dashboard-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,yCAAyC,CAAC;IACrD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACzD,GAAG,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAAqB;IAC1D,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAChE,IAAI,KAAK;YAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7G,CAAC"}

package/dist/backend/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "2e9368e163e9f2863919d459b68456251d18e0cf",
-  "builtAt": "2026-10-26T06:08:07.555Z"
+  "commit": "15fcf0d694103fbeb52ec264473fddf993612837",
+  "builtAt": "2026-10-26T07:21:39.075Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewly",
-  "version": "1.20.429",
+  "version": "1.20.431",
   "type": "module",
   "description": "Multi-agent orchestration platform for AI coding teams — coordinates Claude Code, Gemini CLI, and Codex agents with a real-time web dashboard",
   "workspaces": [